Is lwIP SMTP client 2.2.1 affected by CVE-2026-15340?
Yes. CISA’s October 06, 2026 ICS advisory lists lwIP SMTP client 2.2.1 as the affected version associated with CVE-2026-15340.
The affected version
| Product | Affected version | CVE |
|---|---|---|
| Savannah lwIP SMTP client | 2.2.1 | CVE-2026-15340 |
If you are checking exposure, the confirmed version to compare against is lwIP SMTP client 2.2.1.
What the vulnerability involves
CISA characterizes the weakness as a classic buffer overflow caused by copying input without checking size.
The advisory says successful exploitation could crash the accessed device. It also says the buffer overflow condition may permit remote code execution.
What to verify next
The provided context does not include patch, workaround, or upgrade details. Operators should review the current CISA advisory before deciding what action applies to their specific deployment.
What should Energy and Water or Wastewater operators do after the Savannah lwIP SMTP client advisory?
Energy and Water or Wastewater operators should first check whether their environment uses Savannah lwIP SMTP client 2.2.1, because CISA lists that version as affected by CVE-2026-15340.
Immediate checks for operators
Based on the provided advisory summary, the practical steps are:
- Identify whether lwIP SMTP client 2.2.1 is present in the environment.
- Treat the issue as relevant if that affected version is deployed.
- Review the current CISA advisory for any mitigation or remediation instructions.
The context does not include the full mitigation text, so it would be a mistake to invent a patch step or configuration change here.
Why these sectors are named
CISA lists Energy and Water and Wastewater Systems as affected critical infrastructure sectors. The advisory also says deployment is worldwide.
The reported risk is operationally important because successful exploitation could crash the accessed device, and the buffer overflow condition may permit remote code execution.
Use the live advisory before acting
Because vulnerability advisories can be updated, operators should confirm the latest CISA guidance before making changes in production systems.
What changed in CISA’s October 06, 2026 advisory for the Savannah lwIP SMTP client?
CISA published an ICS advisory for the Savannah lwIP SMTP client on October 06, 2026. The key information in the provided context is the affected version, the CVE, and the type of weakness.
What the advisory added
The advisory identifies:
- Product: Savannah lwIP SMTP client
- Affected version: lwIP SMTP client 2.2.1
- CVE: CVE-2026-15340
- Weakness type: classic buffer overflow
CISA describes the weakness as copying input without checking size.
What impact CISA described
The advisory says successful exploitation could crash the accessed device. It also says the buffer overflow condition may permit remote code execution.
CISA lists Energy and Water and Wastewater Systems as affected critical infrastructure sectors and says deployment is worldwide.
What to watch next
The provided context does not include patch instructions or a remediation timeline. For operational decisions, check CISA’s current advisory page for any updated mitigation guidance.
Sources / Learn more
Related reading
- How can lwIP users determine whether their MQTT Client Application version is vulnerable?; What should teams do to update affected lwIP MQTT Client Application deployments?; How does CVE-2026-87121 change the risk profile for devices using the lwIP MQTT Client Application?
- How can teams determine whether their SIMOVE Fleetmanager or SIPLANT version is affected by CVE-2026-67367?; What should Siemens SIMOVE Fleetmanager and SIPLANT users do after the September 22, 2026 CISA advisory?; What could the path traversal vulnerability allow an attacker to access?; Which SIMOVE Fleetmanager versions are listed as affected before the fixed releases?
- How should organizations mitigate CVE-2026-34223 in Siemens Desigo CC family V6 and V7?; Which Siemens Desigo CC versions are affected by the client code execution vulnerability?; How can specially crafted graphics documents lead to client code execution in Desigo CC?; What changed after CISA’s September 22, 2026 advisory for Siemens Desigo CC family?
- Which ABB PCM600 versions are affected by the October 1, 2026 CISA advisory?; What should energy-sector operators check in ABB PCM600 after the CISA advisory?; What changes in risk does the PCM600 Scheduler Service vulnerability create for standard users?
Leave a Reply